Joined Cases C-26/22 and C-64/22, SCHUFA Holding (Discharge from remaining debts): Judgment of the Court (First Chamber) of 7 December 2023 (requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden — Germany) — UF (C-26/22), AB (C-64/22) v Land Hessen (Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Article 5(1)(a) — Principle of ‘lawfulness’ — Point (f) of the first subparagraph of Article 6(1) — Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party — Article 17(1)(d) — Right to erasure where personal data have been unlawfully processed — Article 40 — Codes of conduct — Article 78(1) — Right to an effective judicial remedy against a supervisory authority — Decision taken by the supervisory authority on a complaint — Scope of judicial review of that decision — Credit information agencies — Storage of data from a public register relating to the discharge of remaining debts in favour of a person — Storage period)
Date: 2023-12-07
Institutions: Court of Justice
Subjects: code of conduct, credit rating, data protection, data-processing law, database, financial solvency, judicial review, personal data, protection of privacy, right to justice








C_202400917EN.000101.fmx.xml












Official Journal of the European Union


EN
Series C













C/2024/917


29.1.2024





Judgment of the Court (First Chamber) of 7 December 2023 (requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden — Germany) — UF (C-26/22), AB (C-64/22) v Land Hessen
(Joined Cases C-26/22 and C-64/22, (1) SCHUFA Holding (Discharge from remaining debts))
(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 5(1)(a) - Principle of ‘lawfulness’ - Point (f) of the first subparagraph of Article 6(1) - Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party - Article 17(1)(d) - Right to erasure where personal data have been unlawfully processed - Article 40 - Codes of conduct - Article 78(1) - Right to an effective judicial remedy against a supervisory authority - Decision taken by the supervisory authority on a complaint - Scope of judicial review of that decision - Credit information agencies - Storage of data from a public register relating to the discharge of remaining debts in favour of a person - Storage period)
(C/2024/917)
Language of the case: German

Referring court

Verwaltungsgericht Wiesbaden

Parties to the main proceedings


Applicants: UF (C-26/22), AB (C-64/22)

Defendant: Land Hessen

Intervener: SCHUFA Holding AG

Operative part of the judgment







1.


Article 78(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
must be interpreted as meaning that a decision on a complaint adopted by a supervisory authority is subject to full judicial review.










2.


Article 5(1)(a) of Regulation 2016/679, read in conjunction with point (f) of the first subparagraph of Article 6(1) of that regulation,
must be interpreted as precluding a practice of private credit information agencies consisting in retaining, in their own databases, information from a public register relating to the grant of a discharge from remaining debts in favour of natural persons in order to be able to provide information on the solvency of those persons, for a period extending beyond that during which the data are kept in the public register.










3.


Article 17(1)(c) of Regulation 2016/679
must be interpreted as meaning that the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where he or she objects to the processing pursuant to Article 21(1) of that regulation and there are no overriding legitimate grounds capable of justifying, exceptionally, the processing in question.










4.


Article 17(1)(d) of Regulation 2016/679
must be interpreted as meaning that the controller is required to erase unlawfully processed personal data as soon as possible.






(1)  
            OJ C 148, 4.4.2022.


ELI: http://data.europa.eu/eli/C/2024/917/oj
ISSN 1977-091X (electronic edition)